arXiv Releases $M^3$: A Novel Framework for Multi-Turn Jailbreaking Detection and Evaluation

Summary:$M^3$ is a novel automated red-teaming framework that formalizes multi-turn jailbreaking as a finite-horizon Markov Decision Process (MDP), significantly improving Attack Success Rates (ASR). Experiments across benchmarks and target models show that $M^3$ outperforms state-of-the-art methods by up to 53% in ASR@5, even with lightweight attackers achieving substantial gains. Additionally, $M^3$ demonstrates steeper risk escalation and more consistent performance across risk categories, offering a

---

Technical Mechanism Analysis

The core innovation of the $M^3$ framework lies in formalizing the multi-turn jailbreaking process as a finite-horizon Markov Decision Process (MDP). Specifically, $M^3$ consists of three main components:

1. Attacker LLM: Responsible for generating adversarial dialogues that progressively bypass the security mechanisms of the target model.
2. State LLM: Generates a compact internal state representation to capture the context and history of the dialogue.
3. Target LLM: The model being attacked, whose security mechanisms are gradually bypassed.

By modeling the attack process as an MDP, $M^3$ can systematically optimize the attack strategy and dynamically adjust the attack path using reinforcement learning techniques, thereby achieving higher attack success rates.

Engineering Trade-offs and Experimental Performance

Experimental results show that $M^3$ excels across multiple benchmarks:

• Attack Success Rate (ASR): $M^3$ improves the ASR@5 metric by up to 53% compared to existing methods. Even with a lightweight attacker model, $M^3$ achieves gains of 26% in ASR@1 and 34% in ASR@5.
• Risk Escalation: $M^3$ demonstrates a steeper risk escalation trend over conversational turns, meaning it can more effectively identify and exploit vulnerabilities in the target model.
• Consistency Across Risk Categories: $M^3$ shows more consistent performance improvements across different risk categories, with a Gini index improvement of up to 4.82, indicating its applicability and reliability in various risk scenarios.

Developer Implementation and Deployment Recommendations

For developers, $M^3$ provides an efficient and scalable framework for multi-turn jailbreaking detection and evaluation. Here are some recommendations:

1. Model Integration: Integrate $M^3$ into existing security assessment workflows to enhance the detection of multi-turn attacks.
2. Parameter Tuning: Adjust the internal parameters of $M^3$, such as the capacity of the attacker LLM and the complexity of the state LLM, according to the specific application scenario to achieve optimal performance.
3. Continuous Monitoring: Use the evaluation results of $M^3$ to continuously monitor the security performance of the target model and update security mechanisms in a timely manner to address new attack strategies.

Conclusion

The $M^3$ framework offers an innovative solution for multi-turn jailbreaking detection and evaluation. Its excellent performance in terms of attack success rate, risk escalation, and consistency across risk categories makes it an important tool in the field of security assessment.

---

Source: ArXiv AI (cs.AI) (2026-10-26)

— END —

Tags: #Multi-turn Jailbreaking Follow #Security Assessment Follow #Reinforcement Learning Follow #MDP Follow #LLMs & Foundation Models Follow